[unisog] Re: Code Red(s) being confused with sadmind/IIS worm?

Paul L Schmehl pauls at utdallas.edu
Fri Aug 10 16:49:55 GMT 2001


--On Friday, August 10, 2001 11:01 AM -0400 Anne Bennett 
<anne at alcor.concordia.ca> wrote:

> a likely sadmind (how does one pronounce that,
> anyway?) infection at that time.
>
I pronounce it s-admin-d, but I suppose you could pronounce it sad mind. :-)

>  (I can't *believe* the volatility of the IIS servers in
> my domain -- this week they've been appearing and disappearing at the
> rate of two per day.)
>
You experience isn't unique.  We have never had two identical scan results. 
I think it has to do with machines being turned off and on at various times 
(unlike servers, these workstations aren't critical - at least their 
"owners" don't think of them that way), and machines being installed 
without any awareness of what's running on them.

Paul L. Schmehl, pauls at utdallas.edu
http://www.utdallas.edu/~pauls/
Supervisor, Support Services
The University of Texas at Dallas
AVIEN Founding Member



More information about the unisog mailing list